What is the CVSS score of CVE-2026-17985?

CVE-2026-17985 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17985?

Yes, a patch is available for CVE-2026-17985. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17985

EUVD-2026-50911 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-jq5x-vmq8-3qr5

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Site isolation bypass implies a changed scope (S:C); modest confidentiality exposure added since cross-origin policy failure can leak data.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in Chrome's Speech component prior to version 151.0.7922.72 enables remote attackers to bypass site isolation - a core security boundary - via a crafted HTML page requiring only user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) signals high integrity impact with no privilege requirement, meaning an unrelated web page can be weaponized as the delivery vehicle. No public exploit code has been identified and EPSS sits at a low 0.18% (8th percentile), consistent with the Chromium team's own 'Low' severity classification despite the NVD medium score; however, the site isolation bypass class of vulnerability is historically sensitive and warrants prompt patching.

Technical ContextAI

Google Chrome's site isolation architecture assigns separate renderer processes to content from distinct origins, enforcing inter-origin security policies to prevent cross-site data leakage or manipulation. The vulnerability resides in the Speech subsystem - likely tied to the Web Speech API (SpeechRecognition or SpeechSynthesis) - where policy enforcement is insufficiently applied, permitting the Speech component to operate in a manner that crosses site isolation boundaries. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome desktop builds prior to 151.0.7922.72. No CWE was assigned in the NVD record, which limits root-cause classification; however, the 'insufficient policy enforcement' phrasing points toward a missing or bypassable security check in the permission or process-isolation layer governing the Speech API rather than a memory-safety bug.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later immediately via the browser's built-in update mechanism (Help > About Google Chrome) or through enterprise deployment tooling. The vendor-released patch is confirmed by the Chrome Stable Channel update blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible in managed environments, a compensating control is to disable or restrict the Web Speech API through enterprise policy (ChromePolicy: SpeechRecognitionEnabled=false), which eliminates the vulnerable attack surface but will break voice-input features for end users. Additionally, enforcing strict Content Security Policy headers server-side and enabling Site Isolation enforcement via Chrome enterprise policies (SitePerProcess=true, which is the default on desktop) reduces - but does not eliminate - the blast radius of site isolation bypass classes.